BSOD probably caused by Ntfs.sys, ntkrnlmp.exe, win32k.sys

Thanks again for all your help, Arc. There are a couple of drivers I am about to update (Audio, BIOS, and Chipset) and then I am going to attempt the Repair Install.

It may be a moot point reporting this, but the PC crashed again today. Although, I don't know if the crash dump will even be worth anything because Driver Verifier was not running at the time. The user complained to me that the PC was slow and having issues with applications, so I switched off verifier.exe last night! So of course with my luck, the PC crashes about 12 hours later. I debugged the dump file, and once again ntkrnlmp.exe looks like the culprit.

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\User.DOMAIN\Desktop\020513-15069-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\debug_symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
Machine Name:
Kernel base = 0xfffff800`02a51000 PsLoadedModuleList = 0xfffff800`02c95670
Debug session time: Tue Feb 5 11:15:05.682 2013 (UTC - 5:00)
System Uptime: 0 days 12:50:37.483
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
.....

*Bugcheck Analysis*

Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80002d98faa, fffff8800830a720, 0}
Probably caused by : ntkrnlmp.exe ( nt!CmpKcbCacheLookup+84a )
Followup: MachineOwner
---------

I will follow your instructions, and if something happens afterwards, I will let you know. Dump file attached.

Thanks,

JMT83

Arc said:

Well done, JMT83 :)

If there are issues those SFC cannot fix, we usually recommend Repair Install.

If there is any further issue, let us know.

Arc,

I have Microsoft Security Essentials installed on the PC, and to the best of my knowledge, the NIC is up to date.

I ran TDSSKiller, but nothing was detected. I was planning on running Windows Defender Offline, but the PC crashed while I was burning the CD. It was getting late and I needed to leave the office, so I did not reattempt to make the Defender Offline CD.

I have yet to attempt the Repair Install. I wanted to burn an image of the PC in its current state before attempting the repair, but I didn't have enough blank CDs to backup the computer. I was afraid that if the PC crashed while attempting the Repair Install, it might end up in worse shape than it is now. I still plan on attempting the Repair Install, but it will be a day or so before I can do so.

MSINFO and Crash Dump attached.

Arc said:

Search for any possible updates of Broadcom NetXtreme Gigabit Ethernet from Ethernet NIC Driver Downloads | Broadcom.

Scan the system for possible virus infection.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Which antivirus do you use? upload your MSINFO32.nfo file.

1. Click on the start button
2. Type "msinfo32" (without quotes) in the search bar of the start menu, click the resulting link. It will open the System Information window.
3. File>Save. In the "File Name" filed, put "MSINFO32" (without Quote), give the save location to desktop, and click the "save" button.
4. Give the time for processing, it will save a .nfo file on your desktop.
5. Zip it, and upload it following the instruction.

One more thing I wanted to add; I found a TechNet article that relates to the corrupted file revealed from running SFC:

Repairing corrupted file [ml:520{260},l:56{28}]"\??\C:\Windows\Help\mui\0409"\[l:22{11}]"diskmgt.CHM" from store

It would seem that people who had installed Remote Server Administration Tools were getting this error. I installed RSAT on this computer a few weeks ago after the computer could not login on the domain. I have since uninstalled RSAT, but the errors remain.

Honestly, I'm not sure if they are even contributing to the BSODs on this computer since the crashes long predate the installation of RSAT. Just thought it might be worth sharing. Link to TechNet article below:

Runing SFC /Scannow

I updated the ATI video driver to v. 13.1. Is there anything else you suggest before attempting the Repair Install?

Thanks,

JMT83

I just ran scf /scannow and it says there are no more integrity violations?

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>sfc /scannow
Beginning system scan. This process will take some time.
Beginning verification phase of system scan.
Verification 100% complete.
Windows Resource Protection did not find any integrity violations.

7 days after the last crash, 5 days after updating the video driver and stress testing the hell out of it, the PC crashed today with a black screen. Dump file attached.